# Workflows — UAE PDP Law Compliance ## Workflow 1: UAE PDP Law Compliance Programme Implementation ``` TRIGGER: Organisation processes personal data of UAE data subjects │ ├─► Phase 1: Scope and Applicability │ ├─ Step 1.1: Determine if the UAE PDP Law applies: │ │ ├─ Controller or processor established in the UAE? │ │ ├─ Offering goods or services to UAE data subjects? │ │ └─ Monitoring behaviour of UAE data subjects? │ │ │ ├─ Step 1.2: Check if any exemptions apply (Article 3): │ │ ├─ Government security or judicial entities │ │ ├─ Health data under specific health legislation │ │ ├─ Banking/credit data under financial sector regulation │ │ ├─ Personal or family use │ │ └─ Media entities under applicable media regulation │ │ │ ├─ Step 1.3: Determine if free zone regimes also apply: │ │ ├─ DIFC-registered entities: DIFC Data Protection Law │ │ ├─ ADGM-registered entities: ADGM Data Protection Regulations │ │ └─ Dual registration: both federal and free zone laws may apply │ │ │ └─ Step 1.4: Document applicability analysis │ ├─► Phase 2: Data Inventory and Legal Basis Mapping │ ├─ Step 2.1: Conduct data mapping exercise │ │ ├─ Identify all categories of personal data processed │ │ ├─ Identify data subjects (customers, employees, suppliers) │ │ ├─ Map data flows (collection, storage, transfer, sharing) │ │ └─ Identify sensitive personal data under Article 7 │ │ │ ├─ Step 2.2: Map each processing activity to a lawful basis (Article 5) │ ├─ Step 2.3: Establish records of processing activities (Article 8) │ └─ Step 2.4: Review and update privacy notices (Article 13) │ ├─► Phase 3: Data Subject Rights Framework │ ├─ Step 3.1: Implement intake mechanism for data subject requests │ ├─ Step 3.2: Establish identity verification procedure │ ├─ Step 3.3: Create workflows for each right: │ │ ├─ Access and information (Article 14) │ │ ├─ Rectification and erasure (Article 15) │ │ ├─ Restriction (Article 16) │ │ ├─ Portability (Article 17) │ │ ├─ Objection (Article 17) │ │ └─ Automated decision-making (Article 18) │ │ │ └─ Step 3.4: Define response timelines per Executive Regulations │ ├─► Phase 4: Technical and Organisational Measures │ ├─ Step 4.1: Conduct risk assessment for all processing activities │ ├─ Step 4.2: Implement security measures (Article 11): │ │ ├─ Encryption of personal data │ │ ├─ Access controls and authentication │ │ ├─ Logging and monitoring │ │ ├─ Incident detection and response │ │ └─ Regular security testing │ │ │ ├─ Step 4.3: Conduct DPIAs for high-risk processing (Article 9): │ │ ├─ Large-scale processing of sensitive data │ │ ├─ Systematic monitoring of public areas │ │ ├─ Automated decision-making with legal effects │ │ └─ New technologies with high privacy risk │ │ │ └─ Step 4.4: Appoint DPO if required (Article 10) │ ├─► Phase 5: Third-Party Management │ ├─ Step 5.1: Execute controller-processor agreements per Article 20 │ ├─ Step 5.2: Ensure processor implements adequate security │ ├─ Step 5.3: Maintain register of processors and sub-processors │ └─ Step 5.4: Audit processor compliance periodically │ └─► Phase 6: Ongoing Compliance ├─ Step 6.1: Monitor UAE Data Office guidance and decisions ├─ Step 6.2: Conduct annual compliance review ├─ Step 6.3: Update processing records when activities change ├─ Step 6.4: Maintain staff training programme └─ Step 6.5: Test breach notification procedure ``` ## Workflow 2: Cross-Border Transfer Assessment (Article 22) ``` TRIGGER: Proposed transfer of personal data outside the UAE │ ├─► Step 1: Identify Transfer Mechanism │ ├─ Option A: Recipient country on UAE Data Office adequacy list │ ├─ Option B: Standard contractual clauses approved by UAE Data Office │ ├─ Option C: Binding corporate rules approved by UAE Data Office │ ├─ Option D: Approved certification mechanism │ ├─ Option E: Explicit consent after informed of risks │ └─ Option F: Derogation (contract, legal claims, vital interests, public interest) │ ├─► Step 2: Adequacy Assessment (if no adequacy determination exists) │ ├─ Review recipient country's data protection framework │ ├─ Assess rule of law and respect for human rights │ ├─ Assess existence of a supervisory authority │ ├─ Evaluate enforceability of data subject rights │ └─ Consider international commitments of the recipient country │ ├─► Step 3: Implement Safeguards │ ├─ Execute appropriate contractual mechanism │ ├─ Include all requirements specified in Executive Regulations │ ├─ Ensure data subject can enforce contractual protections │ └─ Implement supplementary technical measures where necessary │ └─► Step 4: Record and Review ├─ Document transfer in records of processing activities ├─ Include transfer details in privacy notice ├─ Review transfers annually or when legal framework changes └─ Report to UAE Data Office if required ``` ## Workflow 3: Breach Notification (Article 12) ``` TRIGGER: Detection of a personal data breach │ ├─► Step 1: Breach Assessment (within 24 hours) │ ├─ Confirm breach occurrence and scope │ ├─ Identify data categories and data subjects affected │ ├─ Assess severity and risk to data subjects │ ├─ Determine if sensitive personal data is involved │ └─ Activate incident response team │ ├─► Step 2: UAE Data Office Notification │ ├─ Notify the UAE Data Office within the timeframe prescribed │ │ by the Executive Regulations (specific hours/days) │ ├─ Include required information: │ │ ├─ Nature of the breach │ │ ├─ Categories and number of data subjects affected │ │ ├─ Likely consequences │ │ ├─ Measures taken to address the breach │ │ └─ Contact details of the DPO or responsible person │ └─ File via the prescribed notification mechanism │ ├─► Step 3: Data Subject Notification │ ├─ Determine if breach poses high risk to data subjects │ ├─ If high risk: notify affected data subjects without undue delay │ ├─ Use clear and plain language │ ├─ Include recommended protective actions │ └─ Notification may be waived if technical protections render data │ unintelligible or if subsequent measures eliminate high risk │ └─► Step 4: Post-Breach Actions ├─ Conduct root cause analysis ├─ Implement corrective measures ├─ Update security measures per Article 11 ├─ Document breach in internal register └─ Cooperate with UAE Data Office investigation if applicable ```